Texas Attorney General Ken Paxton today announced that his office, along with the Attorneys General of 45 other States and the District of Columbia have obtained a $17.5 million-dollar settlement against retailer The Home Depot, resolving a multistate investigation of a 2014 data breach which exposed the payment card information of approximately 40 million Home Depot consumers nationwide. Texas led this settlement alongside Connecticut and Illinois and will collect $ 1,777,440.00. 

The breach occurred when hackers gained access to The Home Depot’s network and deployed malware on the retailer’s self-checkout point-of-sale system. The malware allowed the hackers to obtain the payment card information of customers who used self-checkout lanes at Home Depot stores throughout the U.S. between April 10, 2014 and Sept 13, 2014. 

“The Home Depot has agreed to implement and maintain a series of data security practices designed to strengthen information security programs and safeguard consumers’ personal information,” said Attorney General Paxton. “This settlement serves to promote fair but rigorous compliance with state laws which require businesses that collect sensitive personal information to implement procedures to protect consumers’ information from unlawful use or disclosure.” 

In this settlement, Home Depot agreed to develop and maintain a comprehensive information security program, including providing resources for the program’s implementation and required training; employing a duly qualified Chief Information Security Officer to oversee the program and advise Home Depot’s Board of Directors of the company’s security risks; and undertaking a post settlement information security assessment. 

Read a copy of the settlement here.